chrome strict-origin-when-cross-origin cross domain query - nginx

Question

description of the problem:
I have a site which distribute the configurations
https://cliconf.aa.bb.cc/cgi-bin/get-config.cgi
it returns config json and some HTTP headers for cors:
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
access-control-allow-origin: *
access-control-allow-headers: *
I have the app site
https://web.aa.bb.cc/
this two sites a one same domain zone, but app doesn't read config and return error "strict-origin-when-cross-origin"
the curl call
curl -v -H "Origin: https://web.aa.bb.cc/" --url "https://cliconf.aa.bb.cc/cgi-bin/get-config.cgi"
is return 200
* Trying x.x.x.x...
* Connected to x.x.x.x (x.x.x.x) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/xxxxxx.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=*.x.x.x.x
* start date: Jun 15 00:00:00 2022 GMT
* expire date: Jul 14 23:59:59 2023 GMT
* subjectAltName: host "x.x.x.x" matched cert's "*.x.x.x.x"
* issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x5573120e5e80)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET /cgi-bin/config?environment=aws_dev HTTP/2
> Host: x.x.x.x:443
> user-agent: curl/7.81.0
> accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 200
< date: Thu, 12 Jan 2023 14:55:55 GMT
< content-type: application/json
< server: nginx/1.18.0 (Ubuntu)
< vary: Origin
< vary: Access-Control-Request-Method
< vary: Access-Control-Request-Headers
< access-control-allow-headers: *
< access-control-allow-origin: *
< access-control-max-age: 3600
< access-control-expose-headers: Content-Length
<
{"logcollector": "https://x.x.x.x/gelf", "linkFrontend": "https://x.x.x.x", x.x.x.x, "name": "dev", "linkAdminApi": "https://x.x.x.x", "maintenance": false, "manifest_id": "x.x.x.x", "url_appsite": "https://x.x.x.x", "linkSupport": "https://x.x.x.x", "websocketPathFrontend": "wss://x.x.x.x/wsapi" }
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection #0 to host x.x.x.x left intact
I found on article https://developer.chrome.com/blog/referrer-policy-new-chrome-default/
but it's still not clear to me which headers and / or on which side I have to create in order for it to work
all web servers are nginx
conf file of nginx from cliconf.aa.bb.cc
server {
listen *:80;
add_header Access-Control-Allow-Headers *;
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Max-Age 3600;
add_header Access-Control-Expose-Headers Content-Length;
location / {
try_files $uri $uri/ =404;
}
include fcgiwrap.conf;
access_log /var/log/nginx/cliconf.aa.bb.cc-access.log;
error_log /var/log/nginx/cliconf.aa.bb.cc-error.log;
}
I include at main index.html
<meta name="referrer" content="unsafe-url" />
but it still not working.